#!/bin/bash
#
# 部署 SSL 证书到各个服务
# 作者: 知汛项目组
# 最后更新: 2024-11-07

set -e

# 颜色定义
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

# 默认配置
DOMAIN="ws.waterism.tech"
DEPLOY_ALL=false
DEPLOY_FRONTEND=false
DEPLOY_API=false
DEPLOY_CDN=false

# 显示帮助
show_help() {
    cat << EOF
用法: $0 [选项]

部署 SSL 证书到各个服务

选项:
    --domain DOMAIN    域名（默认: ws.waterism.tech）
    --all              部署到所有服务
    --frontend         仅部署到前端应用
    --api              仅部署到API服务
    --cdn              仅部署到CDN服务
    --help             显示此帮助信息

示例:
    # 部署到所有服务
    sudo bash $0 --all

    # 仅部署到CDN
    sudo bash $0 --cdn

    # 指定域名并部署到所有服务
    sudo bash $0 --domain ws.waterism.tech --all
EOF
}

# 解析参数
while [[ $# -gt 0 ]]; do
    case $1 in
        --domain)
            DOMAIN="$2"
            shift 2
            ;;
        --all)
            DEPLOY_ALL=true
            shift
            ;;
        --frontend)
            DEPLOY_FRONTEND=true
            shift
            ;;
        --api)
            DEPLOY_API=true
            shift
            ;;
        --cdn)
            DEPLOY_CDN=true
            shift
            ;;
        --help)
            show_help
            exit 0
            ;;
        *)
            echo -e "${RED}未知参数: $1${NC}"
            show_help
            exit 1
            ;;
    esac
done

# 如果指定了--all，设置所有标志
if [ "$DEPLOY_ALL" = true ]; then
    DEPLOY_FRONTEND=true
    DEPLOY_API=true
    DEPLOY_CDN=true
fi

# 如果没有指定任何部署目标，显示帮助
if [ "$DEPLOY_FRONTEND" = false ] && [ "$DEPLOY_API" = false ] && [ "$DEPLOY_CDN" = false ]; then
    echo -e "${RED}错误: 请至少指定一个部署目标${NC}"
    show_help
    exit 1
fi

# 检查root权限
if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}请使用root权限运行: sudo $0${NC}"
    exit 1
fi

echo "======================================"
echo "部署 SSL 证书"
echo "======================================"
echo "域名: $DOMAIN"
echo ""

# 检查证书文件
CERT_DIR="/etc/letsencrypt/live/$DOMAIN"

if [ ! -d "$CERT_DIR" ]; then
    echo -e "${RED}✗ 证书目录不存在: $CERT_DIR${NC}"
    exit 1
fi

if [ ! -f "$CERT_DIR/fullchain.pem" ] || [ ! -f "$CERT_DIR/privkey.pem" ]; then
    echo -e "${RED}✗ 证书文件不完整${NC}"
    exit 1
fi

echo -e "${GREEN}✓ 证书文件检查通过${NC}"
echo ""

# 部署到前端应用
if [ "$DEPLOY_FRONTEND" = true ]; then
    echo -e "${YELLOW}[1/3] 部署到前端应用...${NC}"
    
    FRONTEND_DIR="/opt/ssl/zhixun-app"
    mkdir -p "$FRONTEND_DIR"
    
    cp "$CERT_DIR/fullchain.pem" "$FRONTEND_DIR/"
    cp "$CERT_DIR/privkey.pem" "$FRONTEND_DIR/"
    
    chmod 644 "$FRONTEND_DIR/fullchain.pem"
    chmod 600 "$FRONTEND_DIR/privkey.pem"
    
    echo -e "${GREEN}✓ 前端证书已部署到 $FRONTEND_DIR${NC}"
fi

# 部署到API服务
if [ "$DEPLOY_API" = true ]; then
    echo -e "${YELLOW}[2/3] 部署到API服务...${NC}"
    
    API_DIR="/etc/hitch/certs"
    mkdir -p "$API_DIR"
    
    cat "$CERT_DIR/fullchain.pem" "$CERT_DIR/privkey.pem" > "$API_DIR/api.pem"
    chmod 600 "$API_DIR/api.pem"
    chown hitch:hitch "$API_DIR/api.pem" 2>/dev/null || chown root:root "$API_DIR/api.pem"
    
    echo -e "${GREEN}✓ API证书已部署到 $API_DIR/api.pem${NC}"
fi

# 部署到CDN服务
if [ "$DEPLOY_CDN" = true ]; then
    echo -e "${YELLOW}[3/3] 部署到CDN服务...${NC}"
    
    CDN_DIR="/etc/hitch/certs"
    mkdir -p "$CDN_DIR"
    
    cat "$CERT_DIR/fullchain.pem" "$CERT_DIR/privkey.pem" > "$CDN_DIR/cdn.pem"
    chmod 600 "$CDN_DIR/cdn.pem"
    chown hitch:hitch "$CDN_DIR/cdn.pem" 2>/dev/null || chown root:root "$CDN_DIR/cdn.pem"
    
    echo -e "${GREEN}✓ CDN证书已部署到 $CDN_DIR/cdn.pem${NC}"
fi

echo ""
echo -e "${GREEN}✓ 证书部署完成${NC}"
echo ""
echo "下一步:"
[ "$DEPLOY_FRONTEND" = true ] && echo "  - 重启前端: docker-compose restart zhixun-app"
[ "$DEPLOY_API" = true ] && echo "  - 重载API: systemctl reload hitch-api"
[ "$DEPLOY_CDN" = true ] && echo "  - 重载CDN: systemctl reload hitch-cdn"

